There is no Linux feature called a container. There are namespaces deciding what your process can see, cgroups deciding what it can use, a pile of networking machinery, and an image that turns out to be a folder plus a chroot or pivot_root call. Five features in a trenchcoat. The author of a from-scratch runtime found this deflating and useful at the same time. Me too. The isolation is real, but it is isolation of view and resources, not a wall. Next time something leaks between containers, you will know exactly which of the five to blame.